fix: filter GITHUB_TOKEN env var from Copilot credential pool

Copilot API does not support classic PATs (ghp_*), only OAuth tokens (gho_*)
or fine-grained PATs (github_pat_*). When GITHUB_TOKEN env var contains a
classic PAT, it should be filtered from the credential pool to prevent
Copilot from appearing in the model picker dropdown.

The _is_ambient_gh_cli_entry() function now also filters entries with
source='env:GITHUB_TOKEN', treating them as ambient/auto-detected rather
than user-explicitly-added credentials.

Fixes issue where Copilot group appeared in WebUI model picker even when
gh auth token was an unsupported classic PAT.

api/config.py

@@ -1255,9 +1255,16 @@ def _is_ambient_gh_cli_entry(source: str, label: str, key_source: str) -> bool:
     """True when a credential-pool entry is a seeded gh-cli token rather than
     one the user added explicitly. Filter these so Copilot doesn't appear in
     the dropdown just because `gh` is installed on the system.
+
+    Also filters GITHUB_TOKEN env var entries, which are auto-detected from
+    the environment and should not cause Copilot to appear in the picker
+    when the token is a classic PAT (ghp_*) that Copilot API doesn't support.
     """
+    source_lower = source.strip().lower()
     return (
-        source.strip().lower() in _AMBIENT_GH_CLI_MARKERS
+        source_lower in _AMBIENT_GH_CLI_MARKERS
+        # Filter GITHUB_TOKEN env var entries (source="env:GITHUB_TOKEN")
+        or source_lower == "env:github_token"
         or label.strip().lower() == "gh auth token"
         or key_source.strip().lower() == "gh auth token"
     )